I've tried posting this xml:


to these addresses:

404 - "Not Found"
404 - "Not Found"
404 - "Not Found"
500 - "Server Error"
404 - "Not Found"
500 - "Server Error"
404 - "Not Found"
404 - "Not Found"
404 - "Not Found"
500 - "Server Error"
404 - "Not Found"
500 - "Server Error"
404 - "Not Found"
404 - "Not Found"

I've tried with and without the **GeoFence plugin**.

Is this actually possible?

I have succeeded in creating roles, usergroups, workspaces, coverageStores and raster layers from GeoTiff files, and dataStores and vector layers from shapefiles, but no progress on creating users.

I gather that some modules require you to change the admin password from the default, so I've done that too. My admin account has ADMIN, GROUP_ADMIN, and ROLE_ADMIN roles, and I've even added a USER_ADMIN role in the case such a thing exists.

I'm running geoserver-2.12-SNAPSHOT from 18 September.

4 Answers 4


For anyone who's still getting problems with this, it's been fixed in v2.15.1. I've updated it and it all works no problems now, although I'm using the rest/security/usergroup/users/ route as I get a 404 if I try rest/usergroups/users



I have found temporary solution for this.

The reason of this is that the XStream cannot map XML/JSON to org.geoserver.rest.security.xml.JaxbUser because there is no alias "user" for this.

There are two solutions for it.

  1. Use full class name with package in your XML/JSON.

Something like this:


  "userName": "test",
  "password": "test",
  "enabled": true

If you use XML there is propably the same way.

  1. Edit org.geoserver.rest.security.UsersRestController class.

Add super class org.geoserver.rest.RestBaseController to it and override two methods

    public boolean supports(MethodParameter methodParameter, Type targetType, Class<? extends HttpMessageConverter<?>> converterType) {
        return JaxbUser.class.isAssignableFrom(methodParameter.getParameterType());

    public void configurePersister(XStreamPersister persister, XStreamMessageConverter converter) {

            persister.getXStream().alias("user", JaxbUser.class);

After one of those solutions you need to add JaxbUser.class to XStream whitelist. The simplest way to do it is adding system/environment/context variable GEOSERVER_XSTREAM_WHITELIST like GEOSERVER_DATA_DIR. E.g -DGEOSERVER_XSTREAM_WHITELIST=org.geoserver.rest.security.xml.JaxbUser

I hope this will be fixed in next versions of Geoserver. By the way the GeoServer Documentation is full of lack and need to be polished.

I have posted the same on Jira.


You are very close. The documentation shows that you need to POST to


As long as you are executing the POST as a user with the role ROLE_ADMIN it should work as expected.

  • 1
    http://localhost:8080/geoserver/rest/usergroup/service/users/ 404 - "Not Found" http://localhost:8080/geoserver/rest/security/usergroup/service/users/ 404 - "Not Found" I'm afraid the documentation has shown lots of examples that are incorrect. Sorry - I can't get sensible formatting in this comment. Commented Sep 28, 2017 at 12:57
  • 2
    The documentation shows the url as /rest/usergroup/[service/<serviceName>/]users/ so if I include the "service" element in the path then that needs to be followed by a service name e.g. "default" or "MyGroup". I should be able to list users at this url but actually I need to include the "security" element in the path to get it to work. Commented Sep 28, 2017 at 13:05
  • please submit a PR for the docs if you find an issue
    – Ian Turton
    Commented Sep 29, 2017 at 10:27
  • 1
    Any news on this? I'm experiencing the same issue with the 2.12.0 version of GeoServer. The docs seems to be wrong, one has to add the /security/ to the url to access the usergroup rest api as mentioned above. The POST to the same url does not work, I get a 500 error. Besides the docs says that I should be able to perform all requests with content-type and accept header application/json but this gives a 406 Not acceptable error. Commented Oct 18, 2017 at 20:40
  • 2
    I am getting similar results, bot xml and json posts are reporting 500 errors for me on GeoServer 2.12.1. Checking the logs I get: Testing /rest/security/usergroup/users/ for monitor filtering ERROR [geoserver.rest] - user com.thoughtworks.xstream.mapper.CannotResolveClassException
    – Bwyss
    Commented Dec 12, 2017 at 0:31

我使用的Json方式,需要在参数外面包一层 user { "user": { "userName": "test", "password": "123456", "enabled": true } } enter image description here

Translation note: The above text translates to "The Json method I use needs to wrap a layer outside the parameters" ...

  • 1
    Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Commented Nov 5, 2021 at 6:11
  • Added a translation. @yl-l where possible, it might be advised to add english translation. (Even if the text isn't high quality, English speakers will likely be able to fix it for you later on.).
    – Shayne
    Commented Dec 19, 2022 at 1:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.